Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
CryptoHarlem founder Matt Mitchell on Hacking for Humanity
Guest:
Matt Mitchell
Published:
Updated:
Duration:
51 min
Episode summary
Earlier this year, the Electronic Frontier Foundation named Matt Mitchell, founder of CryptoHarlem, one of its 2021 Pioneer Award winners for his groundbreaking work to protect Black communities from surveillance. In this episode, Matt talks about what sparked his decision to apply his hacking skills to social justice causes and how that led to his role today as a Technology Fellow for the BUILD program at the Ford Foundation. Matt also discusses what Twitch can do to safeguard creators and the steps anyone can take to better protect themselves online. Why you should listen:
Hear from a hacker working on the frontlines of today’s most important racial justice issues.
Better understand the state of digital surveillance in Black communities.
Hear about what steps platforms such as Twitch can take to better protect creators.
Learn the three things everyone online should do to safeguard themselves on the internet.
Discover where “Mr. Robot” placed an elusive CryptoHarlem Easter egg.
Reach communities through networks of trust Matt promoted CryptoHarlem by spending hours on the street and visiting barber shops, salons, churches, and mosques, because marginalized communities are not reached through Google or Twitter.
Offer an hour of your expertise Security practitioners can apply their skills to causes they care about, such as offering an unsolicited one-hour professional opinion to a local hospital or shelter, without quitting their jobs.
Start with a password manager Matt's top advice is a password manager that generates unique passwords, followed by two-factor authentication using 2fa.directory, and checking what an incognito search reveals about you.
Attack algorithms to find bias Algorithmic bias comes from flawed training data, and Matt argues it is found by thinking adversarially, opening algorithms to outside experts, and running bug bounty style challenges like the one Twitter announced at DEF CON.
Ask how your product could hurt people Teams should intentionally test whether a product works for all people, citing soap dispensers that fail to detect brown hands because no one with brown hands tested them.
Topics covered
Talent Gap
Notable quotes
It's kind of like we're time traveling wizards.
So Password Manager, if I only had one thing I could ever tell someone, it's that.
Surveillance is a military tool.
So all of that hidden bias seeped in, and we ended up with a robot that was more biased than a human.
Questions this episode answers
What is a CryptoParty?
Matt credits Asher Wolf, who started the idea after the Snowden revelations: curious people sit down together, talk about surveillance and privacy, and learn how to protect themselves. CryptoParties now happen around the world. Read this section
What are three things people can do to protect their privacy online?
Use a password manager that generates a unique password for every account, turn on two-factor authentication and move up from text codes to apps and hardware keys, and search for yourself in private browsing mode to find and remove personal information. Read this section
Why is surveillance harmful if you have nothing to hide?
Matt says surveillance is a military tool, and under that level of scrutiny ordinary behavior starts to look wrong. Watchers who are always looking for wrongs will find what they are looking for. Read this section
How can algorithmic bias be fixed?
By having outside experts look for it, which requires algorithms to be open or tested adversarially. Matt also points to diverse teams and bug bounty style programs that let hackers probe algorithms already in use. Read this section
About the guest
Matt Mitchell is a hacker and the founder of CryptoHarlem, which runs digital security sessions for Black communities, first in Harlem and later as a livestream on Twitch. At the time of recording, he was a technology fellow for the BUILD program at the Ford Foundation, focused on keeping the foundation's grantee partners safe. He previously served as director of digital safety and privacy at Tactical Tech, and the Electronic Frontier Foundation named him a 2021 Pioneer Award winner for his work protecting Black communities from surveillance.
And I'm Bella DeShantz Cook. Today, we're talking with Matt Mitchell, founder of CryptoHarlem and a tech fellow at the BUILD program of the Ford Foundation.
Matt works on digital security training programs and security measures for the Ford Foundation's grantees. He's also been a leading voice in protecting the black community from surveillance and working with activists on digital security, encryption, and privacy.
In fact, after we interviewed him, Matt received a pioneer award from the Electronic Frontier Foundation for his work. This was such an eye opening interview. But first, a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers 20 fourseven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
Hey, Jeremiah. Thank you for that very kind introduction. It's really great to see both of you today. I'm really excited to get to know you a little bit more. I think we can just jump right in if that's cool with you. Can you tell me exactly how a hacker ends up working at the Ford Foundation?
Yeah. They didn't know. So now my job's over. So thanks a lot. You heard it here first. Sorry, Ford. Oops. Yeah. No. No. In all seriousness, well, the Ford Foundation, for people who are listening who don't know, they're an institutional philanthropy. They've been around for a very long time. Started by that homie who invented the car, his son Edsel. So it's a long time ago, Henry Ford. And what they do today is they support the fight against inequality. That's all they do. That's their mission statement. It's pretty simple. And how do they do that? They do that by bringing people together, allowing different minds and different movements and different things to strategize. They do that through financial support, 500,000,000 US dollars a year to nonprofits around the world. And they do that through the different things that they create, research, etcetera, for the field, for all people.
And philanthropy is kind of like social justice, positive nonprofit, but like working at a bank at the same time. And they have their own concerns when it comes to cybersecurity, but they have an amazing team there that keeps them safe. But what about the grantee partners? What about the people we support out in the field? And there's a lot of reasons why that becomes really difficult, mostly because they're so different and you have no influence, power or control over them, nor should you. So what I do as a tech fellow is I bring tech, just drop that bouillon cube that is the flavor of tech, into this old kind of industry, or older industry, I should say. And there's a lot of tech fellows doing different things. But as a hacker and someone who's expert on cybersecurity, I focus on how do we keep our grantee partners safe? What are tools and resources we can build and create for them and the world? And so that's my day job.
I was kind of perusing through your website, which is cryptoharlem.com, by the way. And as I was going through there, I noticed a little snippet from, mister Robot.
That is sick. It is. That is so cool. I never even picked that up before, and I've seen, like, every one of those episodes probably 15 times, and that's a little Easter egg that I just never picked up. So for those of you listening, season three episode one, look for it.
Yeah. I mean, I I didn't even see it. You know what I'm saying? Like, I'm lucky. Like, I'm pretty humble, but I'm lucky to have been around for a while and met some really interesting people and worked on some really serious things, you know? And yeah, like, they had called me because they film in New York. You know, I'm based in New York City, CryptoHarlem for a reason. And they were like, Hey, Matt, you got to come through. We're filming, you know? And I was like, Oh, that'd be so dope. But I'm not in the country, so... And then they were like, Yeah, well, we can't hold production back, so you could be in
I was like, Wait, wait, wait, I'll come back. Then they were like, well, as soon as I got back, I called them. And I was like, yo, let's go. You have any more episodes? They're like, oh yeah, we're filming still, but we film in LA now. So they did like a West Coast, East Coast thing, they were they had wrapped, New York production wrapped. So they're like, we'll figure it out. We'll figure it out. We'll find a way to give you a little homage, pay you a little shine. And so then after I watched the first episode, like everyone else does when it premieres, And they wrote me like, yo, did you see it? Did you get it? And I was like, And I already know that they drop all these little things in there. I didn't even see it. And I watched it frame by frame. I was like, what are they talking Yeah. And then I caught it. Yeah. Was so smooth.
Yeah. It was really great. I loved it. And looking at that photo, I'm like, oh my gosh. Like... So I'm I'm actually gonna go back probably tonight and watch it again so I can pick that out myself.
Speaking of cybersecurity though, right, I'm really interested to hear about how you got into cybersecurity and then sort of working at places like, you know, the New York Times and CNN. I mean, to me, that... That's a very sort of interesting career path. How did all that come about?
I was really into what... How things work and what's inside of things, right? And I used to take my toys apart and all that kind of thing. And you know that book, like How Things Works, like the little illustrations for kids, like, that's me. You know what I'm saying? Like, we had one computer for my whole school. It was a really old computer back in the days, in the 80s, you know what I'm saying? Because I'm older. So back now, everyone's got like 3,000 computers in their pocket. But back then, it was one computer. I didn't understand how it worked. I became obsessed with it. I asked my folks, yo, get me a computer. They were like, we're immigrants. We can't afford a computer. But we can get you a magazine subscription about computers. So I'm like, I'm watching other people enjoy their computers. Right? I'm seeing code that I can't enter into my invisible computer. But it it sparked something in me, and I would, like, do anything. You know? Like, I would beg, borrow anything to, like, get on a computer keyboard.
I even drew a little cardboard, computer keyboard, and typed things for fun on it. You know? I was like Rocky in a montage training with Apollo. You know what I'm saying? So eventually, I didn't realize it, but I just developed these skills. And that led to me thinking, Okay, I want to make some first, I didn't have any computer, so I had to get on a computer somehow. Then eventually, built my own computer. I didn't have any software. How do you get software? So people I knew were like, oh, I'll tell you where. I know there's ways and wheres to get. So I just developed actual computer hacking skills. 2600 is based on Long Island. That's grew where up, you know, when I was a kid. And so I grew you know, I developed actual computer hacking skills. And I just needed to find a way to use it. I used my computer skills to help activists and nonprofits back then as a teenager.
And I got my first job a little bit later. And my first job was working at this big corporation. And they were like, yeah, you're just going be rolling out machines on desktops, whatever. I was like, oh, that's easy. But then a little bit later, they had a meeting. And they were like, now we're going tell you what your real job is. And I was like, my real job? Oh, this is weird. And then they were like, your real job is basically corporate surveillance of all employees and staff and reporting all people, which is a thing. Every company, if you work for one, has someone protecting the company's interests. And there's a... Insider threat's a thing. Sometimes they overinvest in that team until they become the problem, right? They become the danger. And I was working for that squad. So my background, I was like, no, this is messed up. I've got to tell people about this. But nobody back then, it's like, it would be very strange if someone talked to you about all this stuff.
So I was just like, look, it just kicked me off on this thing where I must use these skills to raise awareness about how bad things are. My parents, we were involved in conflict and war and all that other stuff. And we know the harms that come from when good intentions go bad. And that's what this is an example of. So I just commit my whole my whole life mission to push it back against all that stuff.
A few years ago, you were really active in hosting crypto parties, and you did a bunch of those in Harlem. And I'm wondering if you can tell us a little bit about what are those, how do they work, who do they benefit, and if they're still going on.
Yeah. Yeah. Yeah, of course. So, you know, what is a crypto party? Props to Asher Wolf, who without there be no crypto parties, you know? So, she's this woman from Australia who's just like, Hey, I'm reading about this Snowden thing, and I'm concerned about invasive listening and electronics, and I wanna know more, like, I don't understand, like, what can I do to protect myself? And of course, the Internet was being the horrible Internet. Boo, shut up. Hey, noob. You don't know what you're talking about, whatever. And that's like the obvious wrong answer for mostly people who have no idea what they're talking about, honestly. But that's besides the point. So the idea of CryptoParty was the idea, like, you know, hey, what if I just got other people who are curious, like me, you know, if you're Asher, and, like, just sat down and just had living room. We just talked about stuff. We learned. We looked it up together. And that's how the whole CryptoParty thing was born, for real for real.
I watched a video about the CryptoParties. It was really interesting. And there was a moment in the video where you talked about how in Harlem, at least, to get folks interested in the meetings, you were handing out flyers on the streets and going to leaders within the community in person and spreading the word rather than spreading the word on Twitter and Facebook and other sites that, like, I often see events talked about. And I'm wondering if you could explain the importance of that approach.
All crypto parties for all different types of people, but CryptoHarlem is for black folks. And if you're part of a marginalized community, you have the dominant culture that you touch on, you know, like, it's kind of like kids who speak maybe a different language, their native tongue at home, but then perfect school English or whatever. Right? So you have the dominant culture that you live in and you must survive in. And then you have this other culture. And for black folks and for all marginalized communities that exist, and it's not online. It's... There's no Google for that. And if you wanna reach the real people, it's all through networks of trust. It's all through these different institutions that mean something culture. And that's why the CryptoParty that I would do in Harlem, it was three hours long. And to go back and circle back to that question, yes, we're still doing it, but now it's online.
That's why I literally just got off, like, an hour ago before this. Now it's on Fridays at 01:00 on Twitch instead of at a community center at Malcolm X and Martin Luther King Boulevard where they intersect, which is really cool, but it wasn't by planning or anything. And when you have a crypto party and you're reaching your community, you need to go to the barber shops and the beauty salons and the churches and the mosque and the in some communities, it's the soccer fields where the parents are there and whatever. And we're really serious about that mission. So the crypto part is three hours long. I spent three hours on the streets just walking around, just talking to people. Just talking, just having a conversation like, hey, do you have a phone? Do you ever have thoughts or questions about how it works? And do have any ideas of what negative things you might be bringing in by bringing this technology into your home, into your life, etcetera?
I love that. I think that's hugely impactful and more so is is it says to people's point, like, if you wanna get out there and make change, you gotta make change. And so I just I just love that. But I'd like to circle back around to this. So there's a lot of a lot of your work. It revolves around the intersection between sort of technology and social justice in this way. Right? And so I'd really like to talk about the role of hackers or people working in the cybersecurity space. And to that point, like, we have a special skill set that many others just do not have, frankly. And so with that, how can we apply that to obtaining justice and ensuring it's used for good?
We do have a special skill set. It's kind of like we're time traveling wizards. And you go back to a day where everyone leaves their things unlocked and their doors unlocked and very simple times, right? But you know, there's just evil wizards, evil time travelers about to hit that village or that town or whatever. But then you're like, I get paid nine to five to make stars show up here. So that's what going do, wiggle my fingers. So that just it just doesn't seem right. That doesn't really make sense. But that's what we're doing. And we have I'm a big comic book nerd. My pops always said, I don't care what you read, long as you read you have to read every day, like insane pages. Right? So I would read, like, Marvel Comics and DC and all that good stuff.
And, you know, Stan Lee, you know, like, with great power comes great responsibility and all that other stuff. It's it's really true. Yeah, it's really true. And you can destroy the planet with the things that we know, with the skills that we have. It doesn't take that much. Industrial control, water filtration systems, nuclear reactors, even someone's, private thoughts and feelings that could expose them and ruin their career, right? All of those things, our weird hobby, our strange interests, it just happens to be that glue that maintains all things, right? And not to go into George Lucas the Force, you know, but it's similar. So you must ask yourself, like, yeah, chase the bag. You know, definitely secure that. Get that money. We're at this point. You got to ask yourself, how many hours do I spend working for that money?
And then how many of those hours in my year do I spend protecting what I care about? I mean, it could be a conversation with a family member or a friend about a password manager. It could be, again, whatever community you care about, whatever the great thing about social justice is it takes so many forms and looks so different. So you're a person of faith and you're like, oh, what about my my religious community? Right? If you're, you know, someone who just has... Is like a fan of a certain thing, it's like, oh, I like that baseball team. Well, what's their cybersecurity look like? Know? So like, it's it's really about taking this skill that we have and applying it in any way towards something bigger than yourself. And it's no disrespect. Like, yeah, you deserve to make money to put shirts on your backs and food in your stomach or whatever, right? But we're at a point where it's bigger than that.
And we're all going be sitting around a fireplace wondering what happened, where there's no computers, and it's like the Mad Max post apocalyptic future. And they'll say, oh, I should have done something, but it's too late. So now's the time. And it's actually not that hard. Like, there are people who are just like, look, I'm looking for anyone to work at my hospital. We have an issue with cybersecurity. We want to get ahead of ransomware. It's like, it doesn't mean you've to quit your gig. Maybe you just say, hey, look, I don't want the job. I could talk to you for like an hour a month, you know, something like that. Or hey, like, you know, there's a shelter for refugees or survivors of domestic abuse, and we have questions, and we have you know, it's like, you know what? Just take it upon yourself to ask. Yeah. Would you take an unsolicited one hour professional opinion? You know?
That's great. I personally have never thought of that. I mean, I've done those things for some of my local community things that I attend. Like, I'll notice certain things that I'm like, oh, that's that's that's really bad. I've got... I've gotta say something. And I go up and I say something, but I've never thought of like, hey. In addition to me saying something, let me let me say... Would you be interested in just sort of a free, like like, session just so I could sit down and help educate your staff, yourself, and and those who are maybe providing technical services for your organization? I'd never thought of that.
I think there's also like a... An... This element of, like, something that I've done in the last few years is just sort of trying to make cybersecurity and personal online security part of, like, typical conversations that I have with my family and friends. Because something that I've realized is that so many of my family and friends and, like, just people in my community in general, they're afraid of their interactions online or they see things that are scary, and they don't know what to do or who to ask.
And sometimes they're afraid to ask me because they're like, oh, I have this really stupid question about how the Internet works. And I think kind of, you know, helping where we can, but also creating these communities of like, hey. Like, I know a little bit about this. Let's talk about it. This is just... This is as normal as talking about our jobs, our hobbies, our interests. I think that helps.
Yeah. Yeah. I mean, there's nothing special about us, you know, like, we have hubris and conceit and really into this skill set, but it's very teachable. And there was a day before you knew the most awesome thing you know, and you were just... And if you keep going back, reverse, you're them. So I think we forget that. You have to hold on to that a little bit if you are gonna talk to someone who doesn't come from this, or you will freak them out. Because we've seen the headlines, right, more frequently. We're seeing all these things about hacks and all... But we understand those headlines. Imagine you didn't know anything about this invisible boogie monster of bacteria living on your hand, let's say, right? And it makes you suddenly sick. And some... You're from a culture that never had Western medicine, someone and from Doctors Without Borders or something is talking to you.
And then they're like, yeah, there's these invisible monsters on your hand that made everyone sick. And all you got to do is dip your hands in the normal water, but with this stuff called soap. You'd be like, what is going on? I can't handle this. So it's also about being able to break it down and be patient and understanding. Right? But I love that you do that, Bella.
Thank you. I think I really like that you brought that up. It's that that culture of, like, openness and learning and group learning because, like you said, as soon as you start coming at a problem with, like, I know all this stuff and, like, oh my goodness, y'all don't know anything, people are not going to be in a position to learn. It's interesting to think about that.
Yeah. You you know, your doctor doesn't talk about, like, let's start with incurable diseases. Like, no. Like, they talk about, hey. Let's talk about health and things you can do to have a better life step by step. Right?
So to that point of helping people better understand, what in your opinion, Matt, are three actions that people can take to protect themselves and their privacy online?
One of them is I used to be the director of digital safety and privacy at this NGO called Tactical Tech, And they made this thing called datadetox.org. So you go to datadetox.org, and it's just simple steps. And I'll tell you my personal three, though. One of them would just be like, if you really wanna double down, just hit that website. But I think the first thing you can do is just use a password manager. Right? And it's... Everything in your life needs to have a unique password. Just if you look at what the average person does, watching streaming video or interfacing with email or social media, those things have to have completely unrelated passwords because hackers, when we get leaks, we get breaches and we see these passwords, we're human beings. Your password is a sports team 123, another sports team 456.
We get the pattern. We got this. Right? So it's better to have a computer make your password up. And not just a locker for your password, but it generates your password. And there's free ones out there too, so there's no reason not to have one. They're all basically the same. There's some minor differences by company on who funds them and what their motivation is or whatever. And some of them offer a lot of free services to different communities, right? Like whether you're a journalist or you work at a nonprofit or you're involved in anything pro democracy, there's ways you can get discounts. Sometimes you just got to email sales if you can't find it by search engine. Or just be real and be like, look, $8 a month is too much for me. How can we get this down? Most of them, I've helped people do this. They actually write them back and they actually hook them up with a code or something. It's real. So Password Manager, if I only had one thing I could ever tell someone, it's that.
Because the breach world is real. I mean, just wade through those those bins and so many pastes and so many so many password leaks. There's nothing you can do to stop a password leak. It's gonna happen. So you might as well make it that you you limit it.
Well, the sticky note on your computer has got some... It's pretty posy. Know, like, that sticky note, I can't see it if I'm a hacker because it's not electronic. And so if you have a book in your house with just names of the site, the password and the username, and they have nothing to do with each other, you've won. That's a password manager. I'm cool with that. I'm pretty realistic. If you look at the number of cyber attacks that came from sticky notes on personal computers, it's zero. Maybe if it's work and you've got, you know, you got a spy at work or some industrial espionage, different story. Don't put a don't put a sticky note on the nuclear codes, but
Just Exactly. But... Yeah. Yeah. That's... I would say that's number one. Number two, outside of the Password Manager, if I was just say tell someone what to do, it would again be like locking down that account further with a two factor, what we hear. Use a second factor. I would just say, if you don't know what it is, just learn about it. There's a website called 2fa.directory. Instead of .com, it's .directory. And it's a it used to be called something else, but they lost the domain. So it's 2fa.directory, and it's just a list of, hey, I banks, every bank that has any kind of two factor. And if it doesn't, you can advocate for it by clicking on a button. So it just makes life really easy. So it's the number two, the letter f, the letter a, dot directory, boom. You go in, you type Facebook, and you just click on the docs. That's the documents on two factor that Facebook writes. Because every website has this, because they know that it's the number one way to take over the accounts on the site.
So they have to create a whole documentation on it, and they have to create steps to do it. And they have to spend tons of money and engineering time on making it work. But they don't make it part of onboarding because they're taught, like, the more stops, the more people drop off. So they don't make it part of when you make your account. So you got to go in, you gotta type in your thing, you gotta read and set it up. And this is kinda like the search engine for all of them. So I would say 2FA, get a second factor. If you're not doing it at all, get a text code. If you're getting a text code, don't stop there. Switch to an app, some kind of third party app. If you already got third party apps, mess around with little hardware tokens and keys and stuff. And just... All... There's levels to this game, and there's always the next one for you. You know what I'm saying? It's like a CrossFit gym.
Yeah. Yeah. You know, like props to the... To Calyx, but you can't hear the shirt. But... Yeah. I mean, it's a nonprofit that does a lot of great work, Privacy by Design, and started by the first person to own an ISP that ever pushed back against a national security letter. Everyone else just rolls and gives your information. But Nick from Calyx was the first person to ever say, hey, this doesn't sound right. I'm gonna talk to the FBI about this, and turned it all around, which is dope. And you said three. So let me think of, like, what would be the third thing to secure? I think the third thing would be to Google yourself in private browsing mode or incognito mode or whatever the mode is on your browser. That makes it that removes all the information that you give it that it already knows about you. And it just gives you the default search results. And see if there's anything there, like your home phone number or home address, that you just don't feel comfortable sharing.
There are steps you can take to remove your personally identifiable information from the internet. If, first of all, any site that listed, you have a way to opt out, even if they don't advertise. Otherwise, they wouldn't exist. But if it was too easy, that site would have a database of zero entries. You know what I'm saying? So they got to make that money. So you could just directly ask the site, how do I opt out of this? And it's usually a convoluted, not the hard like, sometimes it's call this phone mapping, push 1 for this, push 2 for that, push 3. Other ones, it's mail us your license, which you should probably redact some things from, and then we'll prove that it's you, then we'll remove you. They all have some kind of way. If you don't wanna do all those steps, there is a blog post and a GitHub entry called... Excuse my French, it's the the big ass list of data brokers by my friend, Yael, who's a reporter and writer at Consumer Reports now.
But, you know, she wrote this, and it's just all these things that you need to manually go through them and remove yourself. If you did one a day, you'd be doing it for years, though. There's so many of these companies.
A lot of the work that you have done has focused on surveillance, particularly surveillance in communities of color. And I know there are, unfortunately, a lot of folks who kind of don't understand the danger and think like, well, you know, you wouldn't have a problem with surveillance if you weren't doing anything wrong. And I'm wondering if you can talk about that mindset and also how surveillance can lead to real harm and create a culture of fear and intimidation for people.
Yeah. I mean, I'm not a superhero, you know what I'm saying? Like, I used to be a surveillor for the corporate side, and I'm black. So I just do the same... Those things. It's the intersection of my existence. We sometimes confuse public safety with surveillance, right? And there should be the public, that's us, me, you, everyone around us, and the friends we're yet to make, there should be some baseline of security for people and some norms there, right? And how do we create those norms as a society? Well, we decide. There are some societies where those norms are created through barbed wire and bullets, right? There's some societies where those norms are created by like, look, that's just not how we are as a people. Like, we must do this. Think about the kindness. Think about the humanity of the other. So those are different ways to go at it.
Surveillance is a military tool. Normal... It's not it's in the barbed wire and bullets camp of finding out if something is wrong. And communities that live on the margins, they're pushed out there. And they're pushed out there by this centrifugal force. And in every society, as I used to travel the world, teaching in conflict zones and teaching NGOs and doing a lot of other work with my hacking skills to help people. And every group sometimes I can't even tell. Like, I'm like, how do you hate this group that's so hard for me to even see the difference between you and them? They don't seem to appear any different than you. But he's like, no, you can tell by their last name or by this license plate we gave them or something. I'm like, wait, that's so strange. But there's always that group. And I'm like, well, how do you know that they're up to no good?
And it's like, well, they must be. And I was like, well, do you ever talk to them? I was like, we don't need to talk to them. We watch them all the time, 20 fourseven. And we're looking, and we're gonna find something wrong. So I would say, like with CryptoHarlem, I often say, looking at the black community and the multi levels of surveillance in the black community, I would invite it to all communities. I would say, let's not take it away from the black community. Let's just make it even to all communities. And then on that day, everyone would be able to have a very frank conversation about how this is not a way to live. But because it's normalized in certain communities, it's just the way it's always been. They're born into it. And once you have one generation that maybe resists a little, but that grows up in something, it's normalized. They don't know any different. You know, I've been to countries where I'm like, does it bother you that this is the way it is here?
And they're like, that's all I know. And you could tell me stories of it being another way, but those might as well be fairy tales. Right? And so I would just say, with this level of surveillance, anyone would say, no, this is too much, and it's not worth any kind of perceived public safety win.
Well, there's a lot of people and a lot of wrongs. Right? And my wrong might not be your wrong, but if we have a 100 of us looking at you, one of us will be like, yeah, that's weird and that's unusual. It's not part of a pattern that I'm used to in my existence. Why does he have to rock that awesome beard and look so cool or whatever? So and I think that's what it is. It's a high level of scrutiny. And under that high level of scrutiny, weird things or apparently weird things show up. On Tuesdays at three, he's always doing this with his ear. You're like, I am? Yeah. I didn't realize it, but you are. So like you know... And if you look at societies, like, you know, I
I know. It's like, yeah. You know, if you if you look at, like, the Gestapo, if you look at any, you know, historical surveillance units and you go back, a lot of our open records now, you look back at what they were writing and what they were finding and what they were seeing and what happened to those people, you're like, these were completely just everyday regular things that under the lens of a surveyor who's always looking for wrongs, you will find what you're looking for all the time. That's one thing I've learned in my... From my former work.
So with the organizations that are that are getting it right or I guess, you know, at least asking the right questions, what do they do when making sure that technology isn't used to further marginalize or unfairly categorize and harm people of color or other, you know, groups?
I usually start a conversation on this with, like, some pretty chill examples. Like, for example, there's soap dispensers where if you put brown hands in front of them, no soap comes out because the sensor just wasn't trained to see that hand as a human hand. So it just thinks like it's shadow or something, and it doesn't dump the soap. Right? So let... Let's talk about, let's say, that product. How did that happen? Well, somehow, it made it all the way to market, got sold and installed, and no one ever tested it who had brown hands. So there's an issue there where you have to say, am I creating a product for all people or just some people, maybe even accidentally? So maybe I should have examples of all people on the consumer side and on the quality assurance side and on the testing side. Then it's my team that's making this. They're excited. We're fixing soap.
Someone had to make that. They're really into that. Whatever that industry is, I don't know. But they're all about it. They have competitors and stuff. But if any of them had brown hands, they would have found this on day zero. So maybe your team just doesn't have that diversity that you think it has. And maybe by removing or not having oftentimes, talk about diversity in staffing. People will say, well, we feel that there's a need, and we understand what's the right thing to do. And I'm like, no, no, it's not the right thing to do. It's actually just business aligned. It's gonna be good for your business, for your products. And you're not gonna... I always say like... I say underestimated when I talk about these groups that are... That I'll be like, look, like, you obviously... We've underrepresented groups in your industry, but they're also underestimated in your industry. There's experts who you'd have to beg to work here who are experts of this, who will are also diverse candidates, right?
But you have to actually think, like, well, where are diverse candidates? There was a very famous moment where I think it was like Wells Fargo or someone, but it could be any bank, really. During an accidental hot mic moment, this person was like, look, I believe in diversity. It was like to the staff, a meeting, but it's it's so hard to find diverse candidates. It's so hard to find candidates that actually meet the level that we're looking for. And oftentimes, it's not the candidate, it's where you're looking for them. Like I have a hard time finding, I don't know, flying animals in the ocean. So you have to make sure you're looking. And then you just look towards the sky, and they're all there. So it's literally saturated. There's not enough, but there's definitely more than you can hire. There's definitely more than you can ever hire and you'll ever need for any particular one industry or company, right? So I would say, am I doing it right?
You have to ask yourself, how is this product hurting people? How could this product hurt people? Because I believe all technology... Because I love technology, right? So I believe all technology has a good and bad side. They say like a dual edged sword or whatever, right? And nuclear power, I always say, it can run a city for pennies or could turn a city to ashes, right? So how is our thing able to be at its worst? Like, just have a if you hired one speculative sci fi person on your team, they would black mirror the... That thing, and they would find it for you. But you you just have to ask yourself, like, how could this hurt people? And what are we doing to ensure that it doesn't encroach on civil liberties, on rights, on marginalized people, on on different communities, on different ethnic groups, on different passport holders or citizens, etcetera. And then what are we doing to ensure it doesn't or we lessen some of those harms?
So you sort of touched on this problem of algorithmic bias, which has... Is definitely... I feel like in the last few years has kind of really become more front and center in tech. A lot more people are seeing it, talking about it. And you you also touched on a solution being at the... While creating these products and and whatnot, there should be more diversity in the room. What is actually happening now to fix that problem? What is happening now to create that diversity in the early stages of products? And also, like, we have so many things with algorithmic bias that are already being used by everybody now. How do we fix the things that are already out there?
Let's look at algorithmic bias. So like, what is an algorithm, first of all? It's not this huge mysterious thing. It's just basic rules, right? You might use a streaming service and you type in something and the search doesn't just dump out every literal thing that can come out. It filters it through, well, let's show them all the results but catered towards what they tend to watch by genre, category, language, length, whatever. That might be an algorithm. It's just a set of rules. And the bias in those algorithms comes from when we start trying to train these rules to have the best outcomes, and that training data goes wrong or is incorrect. And to find that problem, we need to think adversarially, we have to attack the algorithm, and you have to be smart enough to do that, right? You have to know enough to dismantle it and say, well, where do these outcomes come by?
Because they look like it works. It always looks good. How do we know that this isn't leaning towards one way or another? And with many examples, like, for example, there was a company that's like, just like, we wanna do better and do more blind hiring, which is good for diversity, and we wanna be less biased. We're So have a computer help us find... Like, go through stacks of resumes and find the best candidates. And the computer just ruled out all women, basically. And it did this by noticing, like, whether you had a hobby that oversaturated a higher percentile of women tended to have, or you were part of a club, or you did... Were part of a program. Things that even us as human beings, we wouldn't realize. Like, really? Like, 90% of the candidates who are women for this kind of job like this thing that doesn't seem like... You know? Like... But the computer was fed a corpus of data, a large body of data that it's trained on, and that data is all the resumes that have ever been entered for this job, back when maybe women couldn't even apply for that job, back when maybe you can say, I don't like the way this person looks or whatever, or I don't like their outfit, I'm not going to hire her.
So all of that hidden bias seeped in, and we ended up with a robot that was more biased than a human. And those are examples on the problems and the difficulties. So how do we solve it? We solve it with having people on the outside who can look for this stuff, which means algorithms have to be open. Most algorithms are proprietary. The good thing is if you have an adversarial approach, you can expose most algorithms. Not knowing what the algorithm is, by just throwing things at it, you can quickly learn well, not quickly, actually, but you can learn what the rules are. And then you can test those rules and assumptions, and we can reverse it. Now, if you hire a woman, you're just built in. She's going to be like, well, why is my resume never showing up? So you accidentally are ahead of the curve and saving yourselves many thousands or tens of thousands of hours by bringing this mindset or this living embodiment of what you're trying to protect against, right, which is sexism, into the room.
If we open our algorithms to experts, like, you know, I was a judge on this Twitter thing where Twitter, the social media platform, news platform as well. They said, you know what? We're going to take one of our algorithms, and we're going open it up to a bug bounty type of program. And we're going to have hackers at DEF CON and anywhere else, really, but we'll announce it at DEF CON, spend a couple of days messing around and see what they could find on an algorithm that's already in use and we've already checked. We found some problems within fixed. And they found tons of stuff that they didn't fix. And that's amazing, right? And that's how we solve it. And some of the people, they were like, hey, I'm looking for stuff that affects me because maybe I might wear a hijab or I might wear a head covering. And I noticed that it's biased against head covers, which it was, this image cropping thing. But other times, are just like, I'm an expert, and I just want to have a swing at it. And I I believe in what is right and I love technology that's fair.
For those that are that are listening to this podcast and you wanna contribute, one of the ways, immediate ways that I could think of maybe, and and Bella will keep me honest here, is you can apply that to an open API, and then you can run that API into a fuzzing mechanism. And for those that don't quite know what fuzzing means, it's taking sort of this word list that that... It's it's it's it's a compiled word list that has just numbers... Untold numbers of things into sort of almost like a dictionary that can apply to, say, you know, the word dress or the word red or the word resume or the word flowers or the word whatever. And you can fuzz that through the API that connects directly into these algorithms to see where they might wind up more than something else.
Yeah. Mean, I think the whole bug bounty thing is a great way to opening it up to algorithms. A lot of times, the rule sets, they'd be okay or they'd appreciate you looking at some algorithms. So there's tons of bug bounty communities out there. And it allows you to just get access to code. And you also can see what other people are finding. In the AI space, it's heavily academic. No offense to the professors and, you know, researchers out there. But there's a newer way of people who are just like, hey. I'm I'm doing this in, with the hacker mindset, the bug bounty mindset to, like, improve the AI mindset, the API mindset. Right? I think, like, those... That makes a lot of sense.
I don't know how involved in the Twitch community or platform you are, but lately, there has been a big issue with basically a... I I think, like, I see this as a cyber security issue, but basically, there is a lack of protection for creators on the platform. And folks have used, like, weaponized the platform to target primarily...
Yeah. Exactly. Yeah. And they're targeting mostly black creators. What's your take on that? How do we pressure this company to step up and create a platform that is safer for their own users?
I mean, it's pretty weird, I think, you know, that there's this product you can buy. Like, imagine there's, like, a bag of chips, and they change the formula, and you keep eating it. You know what I'm saying? So, like, they are so lucky that this community sticks by them because there's all these other platforms they could be using. And yeah, they make money there, that's where their audience is. But if everyone just left tomorrow, there'd be no more Twitch. Right? It'd be like Tumblr lost like 50% of its users because they made a rule. Boom. Right? Things like that. Like OnlyFans was going to lose all their users, so they decided, oh, maybe we should back away from something that we decided on. Right? But in... Sorry, I live in New York, so nothing I could do about this little New York soundtrack from an angle.
Yeah. Exactly. It's real. You know? But at the end of the day, this isn't just Twitch. Twitch is just the latest manifestation of this. The Internet is a horrible place. Right? You know, there's a book, The Internet of Garbage. I definitely recommend it. It talks about bias and abuse online on the Internet. And like tough and horrible places, like, for example, a kindergarten playground is a horrible place, bullies pick on the group that they think they can get away with the most. Right? And that's usually, like, on the Internet would be marginalized communities. Right? So if if you're identified as a woman... You self identify as a woman? You're, like, the number one community that gets targeted on the Internet. If you're black on the Internet, like, get ready. So when the bullies come, they target you first. Right? So there's lot of gaslighting that's not really happening. But once you realize it is happening, you band together. And that's where this boycott of Twitch, which I think was yesterday or the day before, happened, where the creator was just like, you know what?
We're just not going show up today. And you'll see it in the stats. You'll see it in the numbers. And imagine we did it for more than a day. And that's one way, right? But it's strange because the amount of time it takes to get a press release through all the different eyeballs and sign off on it before it can go public, versus the amount of time it takes to have a hackathon where your engineers just sit down and come up with a clumsy solution, it just shows a lack of care, a lack of empathy.
And that's what... What's been really wild to me. So I I use Twitch as a platform. I have at least some insight into into this. What's been super wild to me is that my, like, Twitter feed is full of all of these just regular people who know stuff about software, who are developing, like, intermediary tools for creators to use to help offer protection. And they're doing this, like, over a weekend hackathon. Right? Like, they're just they're just putting something together. Why isn't Twitch?
Yeah. It's pretty easy. I mean, look, if you look like, you know, as a Twitch person, not to turn this into Twitch conversation, but it's a good examination of what's going on across all tech and as an industry, there was an issue where people were playing music in their streams that weren't cleared. And so you'd get a DMCA takedown notice on this. And with YouTube, it's quite a very sophisticated system. And you get a message. And it's like, this part of your stream has music that appears not to be cleared. You could defend against it. You could say, oh, I'll take that part out. And they have all these tools built in to avoid what would be them getting in trouble with larger music industry, motion picture industry, etcetera. Right? And Twitch's handling of that exposed something to me about their engineering setup and how they're... If you follow that, you're like, Right?
And if that is what they do for something they must do under US law, and they can end up not just losing the creators and those people get sued or whatever, but they can actually lose their whole platform by not actually doing what they need to do to protect against piracy, If that's how they handle that, and it does not give me hope or faith in what they will do to protect the very people who give them a paycheck and allow them to have a platform, it's completely user generated content. And these rules have been developed by other user generated content platforms that have been around for decades, whole generations. They're people who weren't born when YouTube came out. So just follow the basic norms of the industry. And anyway, what will happen, I think, is all directly affected people will solve their own problems. If I could sit down with some Python, make a sloppy natural language processing tool, find all the old raids that happened, pull the chats from them, see what the commonalities are, and do some auto blocking with the basic algorithm, probably I could poop that out in a couple of days.
It won't be perfect and beautiful. It's better than what most people have. We're not technical. And they're just sitting there, cannon fodder, right? So we must do something. And it's not just this platform. All platforms will learn this lesson because people will leave. And good people will make tools to help those folks who are directly affected to protect their mental health and their emotional health.
Yeah. I think for me, this is I feel... You know, I'll be candid and say, I haven't spent a ton of time in my life on the Internet until sort of recently. I'm relatively new to cybersecurity comparatively speaking. And this was one of the first instances for me where I'm looking at a company just, like, kind of fail at protecting its users from a cybersecurity standpoint. And then also seeing like, I feel like this was a a protest. This was a protest that happened entirely online on the first. And like, I am looking at this as, like you said, as sort of something that's happening not just on Twitch, but throughout the industry. And I'm curious to see how change... How users can pressure for change, particularly when it's, like you said, less about US law and more about safety and even comfort.
Yeah. Well, I have a long list of businesses and companies and from gaming and Blizzard and, you know, dating with Grindr and, like, you know, that, you know, I I try to push them a little bit in, like, whatever standing I have in a public way. I try to privately, like, reach out to engineers, the head of tech, whatever. Like, hey. Like, what what is wrong? Like, is it a financial thing? Is it... What's the road map look like? Like, are there some things going on in your industry? Like, what can we do to help you fix this? This is a problem. But you have to care. Right? That's the first step. You have to actually care. Can't force someone to care.
100% agree with that. I think it starts with caring. And to that point, I'm gonna kinda make a weird hard left. So to the caring aspect, where can people hear more from you, stay up to date with your initiatives, and show that they care?
So, yeah, I mean, I would say, first of all, it's just like listening to streams like this. So, like, thank you for even hearing my words and taking the time. We're all, like, you know, rich or poor, you don't get the time back, you know, twenty four hours. That's it. You just spent some time listening to this and learning about this. That means the most to me. I would just say, like, learn more about these issues, whether it's, like, watching a documentary like Coded Bias, which is on Netflix and anyone can watch it, or reading books like Dark Matters by Simone Browne, which is a research book. It's so well written, though. It talks about the history of surveillance of black folks. And it's academic. It's very even keel. It's extremely well researched and fact checked. But most of all, just like find a way to give back with your skills to something that you feel is good.
That's all I'm doing, but I just crank it up to 11, right? So I would just say, do that same thing. Just spend one hour doing that. If you want to hear more about me, CryptoHarlem dot com is our... The website for CryptoHarlem. We have a thing there. You could donate time and just try to help us with something, or you could watch our livestream on Twitch or wherever we move it to if Twitch doesn't wake up. You can... You know, like, that's... I'm on Twitter. I'm Gemini Matt on Twitter. I have open DMs.
I'm an identical twin. That's not obvious. That's not on my LinkedIn profile or Twitter profile. I'm I'm most of the other things about me you could guess because they're just like nerd tropes. Like, I have a I have a glass case of figurines of different things that cover you know, like, I've got a stack of challenge coins or whatever. But I think, like, you know, a lot of people throw around the word hacker. I'm a real hacker. You know what I'm saying? Like, you show me some software or hardware. I can hack it. Fast or slow, I could really do that. So I think, like, that's not something that is, like, evident there. I don't think that's really a common thing, but I don't think it's really useful that anymore. It used to need to be useful, but now I think that it doesn't have to be. But, yeah, that's that. I don't know. I'm trying to think of cool stuff, but that's... I'm vegan. I believe in animal rights. You don't have to, but I don't eat those things. And that's it. Let those let those little cartoon bunnies pop away.
Cloud cybersecurity is a large penetration point for malicious actors. See how your organization can be protected at synack.com. That's synack.com. Check out the show notes to learn more.
